Feeds

Spammers unleash DIY phone number slurping web tool

Well it is Valentine's Day... How else are you going to get those digits?

Using blade systems to cut costs and sharpen efficiencies

Mobile spammers have released a DIY phone number harvesting tool, but instead of advertising it solely on criminals-only online hangouts, they're trying to flog it out in the open.

The availability of the utility turns the simple act of submitting a mobile number to a website something that might lead to the receipt of more SMS (text message) spam.

A new version of the phone number harvesting tool crawls the web and indexes mobile numbers, phone ID numbers, the names of the owner, and the associated mobile operator - among other information. Users of the tool can choose which country they want to target.

The harvested information is later used for various malicious and fraudulent purposes.

Key features of the tool include automatic recognition of Russian and Ukrainian mobile phone providers (based on its initial target market), indexing based on a region and city for both Russia and Ukraine, multi-threaded software allowing up to 100 “indexing streams”, as well as an option to collect only numbers attached to a particular mobile provider.

"Cybercriminals and spammers are not strangers to the concept of market segmentation," explained Dancho Danchev, a security researcher at Webroot, in a blog post.

"Just like true marketers, the developer of the tool has included the option to choose a specific region within the available countries, with the idea to assist in the inevitable malicious and fraudulent activity that will result from this phone number harvesting activity."

Danchev advises surfers to double-check whether any website that requests your phone number is actually listing it on the web. The phone number harvesting tool has yet to crawl through sites that require authorisation or spread outside Russia and the Ukraine, he said, but future versions are likely to expanding indexing capabilities and geographical reach, Danchev warned.

The DIY phone number harvesting tool is an example of a wider trend of selling tools that once were exclusively available to sophisticated cybercriminals to less elite cybercrooks though underground forums. Services that offers a means to launch managed SMS flooding and phone ring flooding have recently become available through these forums. Both managed SMS flooding and phone ring flooding are pitched as a means to “take care of your competitor’s phone lines” or a DDoS attack on phones instead of websites. However, these services might easily lend themselves to helping along more ambitious scams, such as flooding out a bank's call centres to prevent early reports of card fraud cash-out operations, according to Webroot.

"By starting to advertise these very same malicious (DIY) tools and services on publicly accessible forums, they’re proving that they’re willing to sacrifice a certain degree of OPSEC (Operational Security) for the sake of growing their business model and attracting new customers," Danchev reports. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.